diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/Certificate.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/Certificate.java
index 184b2940..292cfe38 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/Certificate.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/Certificate.java
@@ -1345,6 +1345,20 @@ public com.google.protobuf.ByteString getNameBytes() {
   }
 
   public static final int PEM_CSR_FIELD_NUMBER = 2;
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. A pem-encoded X.509 certificate signing request (CSR).
+   * </pre>
+   *
+   * <code>string pem_csr = 2 [(.google.api.field_behavior) = IMMUTABLE];</code>
+   *
+   * @return Whether the pemCsr field is set.
+   */
+  public boolean hasPemCsr() {
+    return certificateConfigCase_ == 2;
+  }
   /**
    *
    *
@@ -2703,6 +2717,21 @@ public Builder setNameBytes(com.google.protobuf.ByteString value) {
       return this;
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Immutable. A pem-encoded X.509 certificate signing request (CSR).
+     * </pre>
+     *
+     * <code>string pem_csr = 2 [(.google.api.field_behavior) = IMMUTABLE];</code>
+     *
+     * @return Whether the pemCsr field is set.
+     */
+    @java.lang.Override
+    public boolean hasPemCsr() {
+      return certificateConfigCase_ == 2;
+    }
     /**
      *
      *
diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateAuthority.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateAuthority.java
index c03e32ca..68ea49bd 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateAuthority.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateAuthority.java
@@ -10949,6 +10949,22 @@ public interface KeyVersionSpecOrBuilder
       // @@protoc_insertion_point(interface_extends:google.cloud.security.privateca.v1beta1.CertificateAuthority.KeyVersionSpec)
       com.google.protobuf.MessageOrBuilder {
 
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name for an existing Cloud KMS CryptoKeyVersion in the
+     * format
+     * `projects/&#42;&#47;locations/&#42;&#47;keyRings/&#42;&#47;cryptoKeys/&#42;&#47;cryptoKeyVersions/&#42;`.
+     * This option enables full flexibility in the key's capabilities and
+     * properties.
+     * </pre>
+     *
+     * <code>string cloud_kms_key_version = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return Whether the cloudKmsKeyVersion field is set.
+     */
+    boolean hasCloudKmsKeyVersion();
     /**
      *
      *
@@ -10982,6 +10998,22 @@ public interface KeyVersionSpecOrBuilder
      */
     com.google.protobuf.ByteString getCloudKmsKeyVersionBytes();
 
+    /**
+     *
+     *
+     * <pre>
+     * Required. The algorithm to use for creating a managed Cloud KMS key for a for a
+     * simplified experience. All managed keys will be have their
+     * [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.security.privateca.v1beta1.CertificateAuthority.SignHashAlgorithm algorithm = 2 [(.google.api.field_behavior) = REQUIRED];
+     * </code>
+     *
+     * @return Whether the algorithm field is set.
+     */
+    boolean hasAlgorithm();
     /**
      *
      *
@@ -11168,6 +11200,24 @@ public KeyVersionCase getKeyVersionCase() {
     }
 
     public static final int CLOUD_KMS_KEY_VERSION_FIELD_NUMBER = 1;
+    /**
+     *
+     *
+     * <pre>
+     * Required. The resource name for an existing Cloud KMS CryptoKeyVersion in the
+     * format
+     * `projects/&#42;&#47;locations/&#42;&#47;keyRings/&#42;&#47;cryptoKeys/&#42;&#47;cryptoKeyVersions/&#42;`.
+     * This option enables full flexibility in the key's capabilities and
+     * properties.
+     * </pre>
+     *
+     * <code>string cloud_kms_key_version = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return Whether the cloudKmsKeyVersion field is set.
+     */
+    public boolean hasCloudKmsKeyVersion() {
+      return keyVersionCase_ == 1;
+    }
     /**
      *
      *
@@ -11232,6 +11282,24 @@ public com.google.protobuf.ByteString getCloudKmsKeyVersionBytes() {
     }
 
     public static final int ALGORITHM_FIELD_NUMBER = 2;
+    /**
+     *
+     *
+     * <pre>
+     * Required. The algorithm to use for creating a managed Cloud KMS key for a for a
+     * simplified experience. All managed keys will be have their
+     * [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
+     * </pre>
+     *
+     * <code>
+     * .google.cloud.security.privateca.v1beta1.CertificateAuthority.SignHashAlgorithm algorithm = 2 [(.google.api.field_behavior) = REQUIRED];
+     * </code>
+     *
+     * @return Whether the algorithm field is set.
+     */
+    public boolean hasAlgorithm() {
+      return keyVersionCase_ == 2;
+    }
     /**
      *
      *
@@ -11695,6 +11763,25 @@ public Builder clearKeyVersion() {
         return this;
       }
 
+      /**
+       *
+       *
+       * <pre>
+       * Required. The resource name for an existing Cloud KMS CryptoKeyVersion in the
+       * format
+       * `projects/&#42;&#47;locations/&#42;&#47;keyRings/&#42;&#47;cryptoKeys/&#42;&#47;cryptoKeyVersions/&#42;`.
+       * This option enables full flexibility in the key's capabilities and
+       * properties.
+       * </pre>
+       *
+       * <code>string cloud_kms_key_version = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+       *
+       * @return Whether the cloudKmsKeyVersion field is set.
+       */
+      @java.lang.Override
+      public boolean hasCloudKmsKeyVersion() {
+        return keyVersionCase_ == 1;
+      }
       /**
        *
        *
@@ -11834,6 +11921,25 @@ public Builder setCloudKmsKeyVersionBytes(com.google.protobuf.ByteString value)
         return this;
       }
 
+      /**
+       *
+       *
+       * <pre>
+       * Required. The algorithm to use for creating a managed Cloud KMS key for a for a
+       * simplified experience. All managed keys will be have their
+       * [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
+       * </pre>
+       *
+       * <code>
+       * .google.cloud.security.privateca.v1beta1.CertificateAuthority.SignHashAlgorithm algorithm = 2 [(.google.api.field_behavior) = REQUIRED];
+       * </code>
+       *
+       * @return Whether the algorithm field is set.
+       */
+      @java.lang.Override
+      public boolean hasAlgorithm() {
+        return keyVersionCase_ == 2;
+      }
       /**
        *
        *
diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateOrBuilder.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateOrBuilder.java
index 012134f1..5036c221 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateOrBuilder.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/CertificateOrBuilder.java
@@ -50,6 +50,18 @@ public interface CertificateOrBuilder
    */
   com.google.protobuf.ByteString getNameBytes();
 
+  /**
+   *
+   *
+   * <pre>
+   * Immutable. A pem-encoded X.509 certificate signing request (CSR).
+   * </pre>
+   *
+   * <code>string pem_csr = 2 [(.google.api.field_behavior) = IMMUTABLE];</code>
+   *
+   * @return Whether the pemCsr field is set.
+   */
+  boolean hasPemCsr();
   /**
    *
    *
diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapper.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapper.java
index 771562cb..190b88e8 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapper.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapper.java
@@ -181,6 +181,21 @@ public ConfigValuesCase getConfigValuesCase() {
   }
 
   public static final int REUSABLE_CONFIG_FIELD_NUMBER = 1;
+  /**
+   *
+   *
+   * <pre>
+   * Required. A resource path to a [ReusableConfig][google.cloud.security.privateca.v1beta1.ReusableConfig] in the format
+   * `projects/&#42;&#47;locations/&#42;&#47;reusableConfigs/&#42;`.
+   * </pre>
+   *
+   * <code>string reusable_config = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return Whether the reusableConfig field is set.
+   */
+  public boolean hasReusableConfig() {
+    return configValuesCase_ == 1;
+  }
   /**
    *
    *
@@ -690,6 +705,22 @@ public Builder clearConfigValues() {
       return this;
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Required. A resource path to a [ReusableConfig][google.cloud.security.privateca.v1beta1.ReusableConfig] in the format
+     * `projects/&#42;&#47;locations/&#42;&#47;reusableConfigs/&#42;`.
+     * </pre>
+     *
+     * <code>string reusable_config = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return Whether the reusableConfig field is set.
+     */
+    @java.lang.Override
+    public boolean hasReusableConfig() {
+      return configValuesCase_ == 1;
+    }
     /**
      *
      *
diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapperOrBuilder.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapperOrBuilder.java
index 5117c2e1..eb54dc6b 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapperOrBuilder.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/ReusableConfigWrapperOrBuilder.java
@@ -23,6 +23,19 @@ public interface ReusableConfigWrapperOrBuilder
     // @@protoc_insertion_point(interface_extends:google.cloud.security.privateca.v1beta1.ReusableConfigWrapper)
     com.google.protobuf.MessageOrBuilder {
 
+  /**
+   *
+   *
+   * <pre>
+   * Required. A resource path to a [ReusableConfig][google.cloud.security.privateca.v1beta1.ReusableConfig] in the format
+   * `projects/&#42;&#47;locations/&#42;&#47;reusableConfigs/&#42;`.
+   * </pre>
+   *
+   * <code>string reusable_config = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return Whether the reusableConfig field is set.
+   */
+  boolean hasReusableConfig();
   /**
    *
    *
diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfig.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfig.java
index d3a93822..acf83d84 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfig.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfig.java
@@ -1029,6 +1029,23 @@ public SubordinateConfigCase getSubordinateConfigCase() {
   }
 
   public static final int CERTIFICATE_AUTHORITY_FIELD_NUMBER = 1;
+  /**
+   *
+   *
+   * <pre>
+   * Required. This can refer to a [CertificateAuthority][google.cloud.security.privateca.v1beta1.CertificateAuthority] in the same project that
+   * was used to create a subordinate [CertificateAuthority][google.cloud.security.privateca.v1beta1.CertificateAuthority]. This field
+   * is used for information and usability purposes only. The resource name
+   * is in the format `projects/&#42;&#47;locations/&#42;&#47;certificateAuthorities/&#42;`.
+   * </pre>
+   *
+   * <code>string certificate_authority = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return Whether the certificateAuthority field is set.
+   */
+  public boolean hasCertificateAuthority() {
+    return subordinateConfigCase_ == 1;
+  }
   /**
    *
    *
@@ -1551,6 +1568,24 @@ public Builder clearSubordinateConfig() {
       return this;
     }
 
+    /**
+     *
+     *
+     * <pre>
+     * Required. This can refer to a [CertificateAuthority][google.cloud.security.privateca.v1beta1.CertificateAuthority] in the same project that
+     * was used to create a subordinate [CertificateAuthority][google.cloud.security.privateca.v1beta1.CertificateAuthority]. This field
+     * is used for information and usability purposes only. The resource name
+     * is in the format `projects/&#42;&#47;locations/&#42;&#47;certificateAuthorities/&#42;`.
+     * </pre>
+     *
+     * <code>string certificate_authority = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+     *
+     * @return Whether the certificateAuthority field is set.
+     */
+    @java.lang.Override
+    public boolean hasCertificateAuthority() {
+      return subordinateConfigCase_ == 1;
+    }
     /**
      *
      *
diff --git a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfigOrBuilder.java b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfigOrBuilder.java
index 207e81ff..873b96ed 100644
--- a/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfigOrBuilder.java
+++ b/proto-google-cloud-security-private-ca-v1beta1/src/main/java/com/google/cloud/security/privateca/v1beta1/SubordinateConfigOrBuilder.java
@@ -23,6 +23,21 @@ public interface SubordinateConfigOrBuilder
     // @@protoc_insertion_point(interface_extends:google.cloud.security.privateca.v1beta1.SubordinateConfig)
     com.google.protobuf.MessageOrBuilder {
 
+  /**
+   *
+   *
+   * <pre>
+   * Required. This can refer to a [CertificateAuthority][google.cloud.security.privateca.v1beta1.CertificateAuthority] in the same project that
+   * was used to create a subordinate [CertificateAuthority][google.cloud.security.privateca.v1beta1.CertificateAuthority]. This field
+   * is used for information and usability purposes only. The resource name
+   * is in the format `projects/&#42;&#47;locations/&#42;&#47;certificateAuthorities/&#42;`.
+   * </pre>
+   *
+   * <code>string certificate_authority = 1 [(.google.api.field_behavior) = REQUIRED];</code>
+   *
+   * @return Whether the certificateAuthority field is set.
+   */
+  boolean hasCertificateAuthority();
   /**
    *
    *
diff --git a/synth.metadata b/synth.metadata
index 04ae0467..2d9c9a24 100644
--- a/synth.metadata
+++ b/synth.metadata
@@ -4,15 +4,15 @@
       "git": {
         "name": ".",
         "remote": "https://github.com/googleapis/java-security-private-ca.git",
-        "sha": "dbf1419fa1940ad26431e683bf549ad55a852778"
+        "sha": "33f32d1a45cb85822c8609d915c5813c80525eda"
       }
     },
     {
       "git": {
         "name": "googleapis",
         "remote": "https://github.com/googleapis/googleapis.git",
-        "sha": "af8f71dae961ee036a0ac52a1965270149a6b2c9",
-        "internalRef": "358516065"
+        "sha": "f6dd7e47620566925a4b3f1ce029e74e1b2f2516",
+        "internalRef": "359781040"
       }
     },
     {